From 27a03953379b8939b490a6517b8642f84339b227 Mon Sep 17 00:00:00 2001 From: Irving Popovetsky Date: Thu, 29 Oct 2026 18:10:43 -0700 Subject: [PATCH 1/2] Move admin SSH CIDR to a variable and add it as an output The admin home IP changed. Move the SSH CIDR to the admin_ssh_cidr variable, set in the git-ignored terraform.tfvars, so the IP is not committed to git. Co-Authored-By: Claude Opus 5.5 --- terraform/asg.tf | 7 ++++++- terraform/variables.tf | 4 ++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/terraform/asg.tf b/terraform/asg.tf index 08f98ec..ffe6b29 100644 --- a/terraform/asg.tf +++ b/terraform/asg.tf @@ -16,6 +16,11 @@ output "ecs_ami_name" { value = local.ecs_ami["image_name"] } +output "admin_ssh_cidr" { + description = "CIDR allowed to SSH to the ECS instances" + value = var.admin_ssh_cidr +} + # https://registry.terraform.io/modules/terraform-aws-modules/autoscaling/aws/latest module "autoscaling" { source = "terraform-aws-modules/autoscaling/aws" @@ -150,7 +155,7 @@ module "autoscaling_sg" { ingress_with_cidr_blocks = [ { rule = "ssh-tcp" - cidr_blocks = "71.237.173.68/32" + cidr_blocks = var.admin_ssh_cidr } ] diff --git a/terraform/variables.tf b/terraform/variables.tf index e69de29..bba16ea 100644 --- a/terraform/variables.tf +++ b/terraform/variables.tf @@ -0,0 +1,4 @@ +variable "admin_ssh_cidr" { + description = "CIDR allowed to SSH to the ECS instances. Set in terraform.tfvars, which git ignores." + type = string +} From f4779bde92a6d141bd35a20d7f222dcd24f03f70 Mon Sep 17 00:00:00 2001 From: Irving Popovetsky Date: Thu, 29 Oct 2026 18:17:42 -0700 Subject: [PATCH 2/2] Validate admin_ssh_cidr is a single IPv4 /32 Reject malformed values and wide ranges such as 0.0.0.0/0 at plan time. Addresses review feedback on the PR. Co-Authored-By: Claude Opus 5.5 --- terraform/variables.tf | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/terraform/variables.tf b/terraform/variables.tf index bba16ea..c50e99d 100644 --- a/terraform/variables.tf +++ b/terraform/variables.tf @@ -1,4 +1,9 @@ variable "admin_ssh_cidr" { description = "CIDR allowed to SSH to the ECS instances. Set in terraform.tfvars, which git ignores." type = string + + validation { + condition = can(cidrhost(var.admin_ssh_cidr, 0)) && endswith(var.admin_ssh_cidr, "/32") + error_message = "admin_ssh_cidr must be a single IPv4 address in CIDR form, such as 203.0.113.10/32." + } }